Apparatus, system, and method for setting protection states of protected partitions in storage media

ABSTRACT

An apparatus, system, and method are disclosed for setting protection states of protected partitions in storage media. The apparatus includes a control module configured to receive protection state transition commands from a host for a target partition, a check module configured to verify a protection state for the target partition, and a write module configured to perform the protection state transition according to a plurality of defined allowable state transitions. The system includes a host device, a storage device coupled with the host, the storage device comprising an enclosure having storage media and a control module, and the apparatus. The method includes receiving protection state transition commands from a host for a target partition, verifying a protection state for the target partition, and performing the protection state transition according to a plurality of defined allowable state transitions.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to storage media and more particularly relates toimplementing protected partitions in storage media

2. Description of the Related Art

The explosion of data created by e-business is making storage astrategic investment priority for companies of all sizes. As storagetakes precedence, a major concern has emerged: the need to archive datain a non-rewritable and non-erasable manner. This need is based in parton the need to meet the legal requirements of the management offinancial data, such as required by the Securities and ExchangeCommission and HIPPA, as well as the archival of court records, customerrecords, and other long-lived information. Traditionally, optical mediahas been used to store date in non-rewritable and non-erasable form.Non-rewritable and non-erasable data may also be referred to asreference data, fixed content data, or Write Once Read Many (WORM) data.

Information technology providers are increasingly migrating WORM data todisk based storage subsystems due to the constantly dropping price andincreasing storage capacity of the disks in the storage subsystems. Adisk based storage subsystem may be part of a Storage Area Network. TheStorage Network Industry Association (SNIA) defines SAN as a networkwhose primary purpose is the transfer of data between computer systemsand storage elements. A SAN may comprise a communication infrastructure,which provides physical connections; and a management layer, whichorganizes the connections, storage elements, and computer systems sothat data transfer is secure and robust. A SAN may also include astorage system comprising storage elements, storage devices, computersystems, and/or appliances, plus all control software, communicatingover a network.

Commonly, a storage area network includes a plurality of storagedevices, such as tape drives or hard disk drives, connected with astorage or disk controller. The disk controller is generally a serverthat is configured to process read/write requests from hosts or clientmachines. The hosts may be running a variety of operating systems suchas Windows, Linux, UNIX, AIX, zOS, etc. In large computing environments,the storage area network is an ideal solution for providing largeamounts of storage and scalable server or storage controllerperformance.

Typically, in a storage area network environment, a host requests datafrom the disk controller. The disk controller then retrieves the datafrom the particular storage device that contains the requested data,often referred to as a home location. The disk controller then sends thedata to the host. If the host modifies the data, the data is sent backto the disk controller which returns the modified data to the homelocation. Typically, the host awaits a response from the disk controllerindicating the read or write operation has completed. The home locationoften takes the form of a partition on the disk drive. A partitionfurther comprises at least one unit of storage of fixed size, or atleast one unit of storage of variable size. In one embodiment, the unitof storage of fixed size is a logical block address (LBA).

The disk controller may also provide functions such as the ability toprovide access by heterogeneous servers, data caching, data availabilityfeatures such as various RAID implementations and clustering,scalability, virtualization of devices, replication services andnon-rewritable and non-erasable storage (WORM). WORM functionality isusually provided by microcode residing outside the storage device ordisk drive, such as in the disk controller, which prevents modification,deletions, and additions to the data stored on disk drives. The diskdrive is usually integrated and enclosed in the subsystem and cannot beremoved. A storage subsystem providing WORM functionality is alsoreferred to as WORM storage subsystem.

Even though WORM storage subsystems are becoming more and more acceptedas a legal means of archiving reference data, there remains a securityconcern: the data on the disk drive is inherently rewritable anderasable. The only protections preventing the alteration or deletion ofarchived data are provided by the controller microcode, which does notallow modifications or deletions, and the physical protection of thedisk drives, which are enclosed in a lockable rack or cabinet. When adisk drive is removed from the storage subsystem the data on that diskdrive is no longer secure and may be overwritten, deleted or otherwisemanipulated. To prevent this, the data can be formatted in a special wayto make the alteration of the data more difficult, however, it is stillpossible to decode the format and manipulate the data. This puts theintegrity of the archived data at more risk than in the past, when thephysical nature of the medium provided a natural barrier to themodification of the data. Furthermore, current WORM systems typicallydepend on proprietary interfaces to the host computer or diskcontroller, which may introduce problems with the existing informationtechnology infrastructure.

From the foregoing discussion, it should be apparent that a need existsfor an apparatus, system, and method that implements protectedpartitions in hard disk drives. Beneficially, such an apparatus, system,and method would utilize a standardized interface and not requireproprietary hardware or interfaces.

SUMMARY OF THE INVENTION

The present invention has been developed in response to the presentstate of the art, and in particular, in response to the problems andneeds in the art that have not yet been fully solved by currentlyavailable partition protection systems. Accordingly, the presentinvention has been developed to provide an apparatus, system, and methodfor setting protection states of protected partitions that overcome manyor all of the above-discussed shortcomings in the art.

The apparatus to set protected partitions is provided with a logic unitcontaining a plurality of modules configured to functionally execute thenecessary steps of protecting partitions. These modules in the describedembodiments include a control module configured to receive protectionstate transition commands from a host for a target partition, and acheck module configured to verify a protection state for the targetpartition

In a further embodiment the apparatus includes a write module configuredto perform the protection state transition according to a plurality ofdefined allowable state transitions. The plurality of protection statesmay also include an auto-protected state configured to allow exactly onewrite operation and subsequently convert to a read-only auto-protectstate, and the read-only auto-protected state configured to preventwrite, erase, and format command once data has been written to thepartition.

In one embodiment, the apparatus includes a plurality of allowableprotection state transitions. The protection state transitions mayinclude a transition from the unprotected state to one of theunprotected state for normal read/write operation, the auto-protectedstate, and the WORM protected state, a transition from theauto-protected state to one of the unprotected state or the read-onlyauto-protected state, and a transition from the read-only auto-protectedstate to the WORM protected state.

In a further embodiment, the apparatus includes a parse moduleconfigured to extract logical block addresses from the protection statetransition command. The storage device may be selected from the groupconsisting of hard disk drives, DVD-R, DVD-RW, DVD-RAM, HD-DVD, Blu-Ray,UDO, CD-R, CD-RW, magneto-optical, phase change, holographic, tapecartridge drives, tape cassette drives, and solid-state media. Thepartition may comprise at least one unit of storage of fixed size, oralternatively one unit of storage of variable size.

A system of the present invention is also presented to implementprotected partitions in storage media. In particular, the system, in oneembodiment, includes the above described apparatus, a host device, and astorage device coupled with the host. The storage device may include anenclosure containing storage media and the control module.

A method of the present invention is also presented for protectingpartitions in storage media. The method in the disclosed embodimentssubstantially includes the steps necessary to carry out the functionspresented above with respect to the operation of the described apparatusand system. In one embodiment, the method includes receiving protectionstate transition commands from a host for a target partition, verifyinga protection state for the target partition, and performing theprotection state transition according to a plurality of definedallowable state transitions.

The method may also include extracting the logical block addresses andprotection statuses from the read and write command. Furthermore, themethod includes allowing transitions from the unprotected state to oneof the unprotected state for normal read/write operation, theauto-protected state, and the WORM protected state, allowing transitionsfrom the auto-protected state to one of the unprotected state or theread-only auto-protected state, and allowing transitions from theread-only auto-protected state to the WORM protected state

Reference throughout this specification to features, advantages, orsimilar language does not imply that all of the features and advantagesthat may be realized with the present invention should be or are in anysingle embodiment of the invention. Rather, language referring to thefeatures and advantages is understood to mean that a specific feature,advantage, or characteristic described in connection with an embodimentis included in at least one embodiment of the present invention. Thus,discussion of the features and advantages, and similar language,throughout this specification may, but do not necessarily, refer to thesame embodiment.

Furthermore, the described features, advantages, and characteristics ofthe invention may be combined in any suitable manner in one or moreembodiments. One skilled in the relevent art will recognize that theinvention may be practiced without one or more of the specific featureor advantages of a particular embodiment. In other instances, additionalfeatures and advantages may be recognized in certain embodiments thatmay not be present in all embodiments of the invention.

These features and advantages of the present invention will become morefully apparent from the following description and appended claims, ormay be learned by the practice of the invention as set forthhereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

In order that the advantages of the invention will be readilyunderstood, a more particular description of the invention brieflydescribed above will be rendered by reference to specific embodimentsthat are illustrated in the appended drawings. Understanding that thesedrawings depict only typical embodiments of the invention and are nottherefore to be considered to be limiting of its scope, the inventionwill be described and explained with additional specificity and detailthrough the use of the accompanying drawings, in which:

FIG. 1 is a schematic block diagram illustrating one embodiment of astorage device in accordance with the present invention;

FIG. 2 is a schematic block diagram illustrating one embodiment ofLogical Block Addressing in accordance with the prior art;

FIG. 3 is a schematic block diagram illustrating one embodiment of thecontrol module in accordance with the present invention;

FIG. 4 is a schematic block diagram illustrating a plurality ofprotection states in accordance with the present invention;

FIG. 5 is a schematic block diagram illustrating one embodiment of amode select command in accordance with the present invention;

FIG. 6 is a schematic block diagram illustrating one embodiment of amode sense command in accordance with the present invention;

FIG. 7 is a schematic block diagram illustrating one embodiment of amode page in accordance with the present invention;

FIG. 8 is a schematic flow chart diagram illustrating one embodiment ofa method for implementing allowable protection state transitions inaccordance with the present invention;

FIG. 9 is a schematic flow chart diagram illustrating one embodiment ofa method for the processing of write commands;

FIG. 10 is a schematic block diagram illustrating one embodiment of awrite command in accordance with the present invention;

FIG. 11 is a schematic block diagram illustrating one embodiment of amedium partition mode page in accordance with the present invention; and

FIG. 12 is a schematic block diagram illustrating one embodiment of amethod for protecting the control module 106 from intentional corruptionof storage devices.

DETAILED DESCRIPTION OF THE INVENTION

Many of the functional units described in this specification have beenlabeled as modules, in order to more particularly emphasize theirimplementation independence. For example, a module may be implemented asa hardware circuit comprising custom VLSI circuits or gate arrays,off-the-shelf semiconductors such as logic chips, transistors, or otherdiscrete components. A module may also be implemented in programmablehardware devices such as field programmable gate arrays, programmablearray logic, programmable logic devices or the like.

Modules may also be implemented in software for execution by varioustypes of processors. An identified module of executable code may, forinstance, comprise one or more physical or logical blocks of computerinstructions which may, for instance, be organized as an object,procedure, or function. Nevertheless, the executables of an identifiedmodule need not be physically located together, but may comprisedisparate instructions stored in different locations which, when joinedlogically together, comprise the module and achieve the stated purposefor the module.

Indeed, a module of executable code may be a single instruction, or manyinstructions, and may even be distributed over several different codesegments, among different programs, and across several memory devices.Similarly, operational data may be identified and illustrated hereinwithin modules, and may be embodied in any suitable form and organizedwithin any suitable type of data structure. The operational data may becollected as a single data set, or may be distributed over differentlocations including over different storage devices.

Reference throughout this specification to “one embodiment,” “anembodiment,” or similar language means that a particular feature,structure, or characteristic described in connection with the embodimentis included in at least one embodiment of the present invention. Thus,appearances of the phrases “in one embodiment,” “in an embodiment,” andsimilar language throughout this specification may, but do notnecessarily, all refer to the same embodiment.

Furthermore, the described features, structures, or characteristics ofthe invention may be combined in any suitable manner in one or moreembodiments. In the following description, numerous specific details areprovided, such as examples of programming, software modules, userselections, network transactions, database queries, database structures,hardware modules, hardware circuits, hardware chips, etc., to provide athorough understanding of embodiments of the invention. One skilled inthe relevant art will recognize, however, that the invention may bepracticed without one or more of the specific details, or with othermethods, components, materials, and so forth. In other instances,well-known structures, materials, or operations are not shown ordescribed in detail to avoid obscuring aspects of the invention.

FIG. 1 is a schematic block diagram illustrating one embodiment of astorage device 100 in accordance with the present invention. The storagedevice 100 may comprise an enclosure 102, storage media 104, a controlmodule 106 and a communication interface 108. The storage media 104 mayinclude, but is not limited to, magnetic, optical, and solid statestorage media. Examples of magnetic storage media 104 include, but arenot limited to, hard disk drives, and tape drives. The communicationinterface 108 may include, but is not limited to, HVD or LVD SCSI, fiberchannel, ESCON, FICON and RS-232.

Examples of optical media include DVD-R (Digital Versatile Disk—WriteOnce), DVD-RW (DVD Rewritable), DVD-RAM (DVD Random Access Memory),HD-DVD (High Definition DVD), Blu-Ray, UDO (Ultra Density Optical), CD-R(Compact Disk—Write Once), CD-RW (CD Rewritable), magneto-optical (MO),phase change (PC), holographic, and the like. Examples of solid statestorage media include volatile memory such as SDRAM, and non-volatilememory such as flash memory.

The control module 106 is configured to receive input and outputrequests (hereinafter “I/O requests or commands) through thecommunication interface 108 from a host and subsequently perform the I/Orequest. The control module 106 may be operatively coupled with thestorage media 102 within the enclosure 102. Alternatively, the controlmodule 106 may be configured to control a plurality of storage media 104over a network. One such implementation includes a storage area network(not shown).

The control module 106 is configured to execute I/O requests, orread/write commands, that access the smallest unit of storage of thestorage media 104. In one embodiment, the smallest unit of storage isthe Logical Block Address (LBA). Logical block addressing translatesphysical locations of the storage media into addresses that can be usedby the host. For example, logical block addressing translates thecylinder, head, and sector specifications of a hard disk drive intoaddresses that can be used by an operating system or basic input/outputsystem (BIOS).

In a further embodiment, the control module 106 may connect to a hostvia a communication link and similarly to the storage media 104. Asdescribed above, the storage media 104 may comprise disk drives, tapedrives, and/or optical drives via an alternative communication link. Thecommunication interface 108 is further configured to receive the I/Orequest and pass the I/O request to the control module. The controlmodule 106 may be configured to perform protocol conversion from ESCONto SCSI or from FICON to SCSI. Furthermore, it may be configured togroup the attached storage media 104 into logical drives or volumes. Thecontrol module 106 may also offer advanced functions, such as RemoteVolume Mirroring, PPRC (Peer-to-Peer Remote Copy), XRC (Extended RemoteCopy), SnapShot, Flashcopy, etc.

FIG. 2 is a schematic block diagram illustrating one embodiment ofLogical Block Addressing 200 in accordance with the prior art. Logicalblock addressing 200 may be used in fixed block architecture (FBA)systems such as hard disk drives, optical disk drives, and removablestorage drives. In FBA peripherals, I/O is done by executing read/writecommands that access the LBA. A LBA references a fixed amount of data.

Storage media 104 may comprise millions of LBAs, depending upon thecapacity of the storage media. FIG. 2 illustrates a plurality of LBA,each LBA represented as a single box 202. As is well known to thoseskilled in the art, LBA may be written in any order, and need not bewritten sequentially from a first LBA 202 a, to a last LBA 202 b.

The last LBA 202 b may also be called the maximum LBA. The capacity ofthe storage media 104 disk drive is determined by the number of LBAs onthe medium and the fixed size of the LBAs 202. For example, assuming atypical LBA size of 512 bytes, a hard disk drive with 10,000,000 LBAsaccounts for a capacity of 5.12 billion bytes.

A partition 204 is an isolated portion of the storage media 104 that maybehave as a separate storage media 104. The partition 204 comprises atleast one LBA 202. For example, partition 204 a may comprise three LBAs202, while partition 204 b comprises one LBA 202, and partition 204 ccomprises two LBAs 202. Alternatively, the partition 204 may comprisemillions of LBAs 202. Storage media 104 may comprise multiple partitionswith each partition 204 having a different protection state. In afurther embodiment, partitions 204 never overlap, meaning that any twopartitions do not contain the same LBA 202.

FIG. 3 is a schematic block diagram illustrating one embodiment of thecontrol module 106 in accordance with the present invention. The controlmodule 106, in one embodiment, comprises a communication module 302, awrite module 304, a parse module 306, a protection module 308, and acheck module 310. The communication module 302 is configured tocommunicate with the host via the communication interface 108 in orderto receive read/write commands and subsequently pass write commands tothe write module 304 or return data to the host as a result of a readcommand.

In a further embodiment, the parse module 306 is configured to extractlogical block addresses and protection statuses from the read/writecommand. The check module 310 is configured to verify the protectionstatus of partitions 204 and LBAs 202 of the storage media 104. Theprotection module 308 is configured with a plurality of protectionstates and allowable transitions between the protection states. Theprotection module 308 will be discussed in greater detail below withreference to FIG. 4. The write module 304 is configured to write data tothe storage media 104 and perform protection status transitions.

FIG. 4 is a schematic block diagram illustrating a plurality ofprotection states in accordance with the present invention. In oneembodiment, the protection states may implemented within the protectionmodule 308. The protection module 308 may comprise an unprotected state402, a Write Once Read Many (WORM) protected state 404, anauto-protected state 406, and a read-only auto-protected state(hereinafter “read-only state”) 408. The unprotected state 402 may bethe default factory setting for the entire storage media 104, and allowsthe performance of an indefinite and repeated number of read/writeoperations to any LBA 202.

This unprotected state 402 remains set for those areas on the storagemedia 104 that are not explicitly configured with the WORM state 404 orthe auto-protected state 406. The WORM state 404 is configured toprotect any partition 204 associated with “WORM Protected” from anyattempted write, erase, or format operation. The auto-protected state406 allows any LBA 202 in an “auto-protected” partition 204 to bewritten exactly once, and after successfully completing the writeoperation the LBAs 202 will automatically transition to the “read-onlyauto-protect” state 408. The remaining LBAs 202 in the partition thathave not been written will remain in auto-protected state 406. Theread-only auto-protect state 408 is configured to prevent any write,erase, and format operations once the LBA 202 has been written.

Arrows 412 represent rules illustrating allowable state transitions ofthe protection state for a partition 204. For example, the protectionmodule 308 is configured to allow a partition 204 having an unprotectedstate 402 to allow rewriting of the data as indicated by arrow 412 a.The unprotected state 402 may be transitioned 412 b to a WORM protectedstate 404 by issuing an appropriate state transition command which willbe explained below. Alternatively, the unprotected state may also bechanged 412 c to the auto-protected state 406 as a result of a statetransition command. As illustrated, the WORM protected state 404 may beconfigured to not allow any state transitions.

The auto-protected state 406 may be configured to allow exactly onesuccessful write command to be issued to the partition 204. When a writecommand has been successfully processed, the protection state for anauto-protected partition 406 will transition 412 d to the read-onlyauto-protected state 408. While there are unwritten LBAs 202, thewritten LBAs 202 are marked as read-only auto protected 408, while theunwritten LBAs 202 remain in the auto-protected state 406. Once all LBAs202 in an auto-protected partition have been written, all LBAs 202within the partition become 412 e WORM protected 404.

In a further embodiment, a partition with the auto-protected state 406may also be changed to the unprotected state 402 by sending anappropriate state transition command 412 f. This, for example, enablescorrection of unwanted state changes, e.g. if the state of a partitionhas been set from unprotected to auto-protected by mistake.

Once a partition is in the WORM protected state 404 or read-onlyauto-protected state 408, the data cannot be overwritten, deleted orotherwise manipulated. Furthermore, the WORM protection state 404 andthe read-only auto-protected state 408 cannot be reset once assigned.This means that any I/O requests for write, erase or format operationsaddressing any LBA pertaining to WORM protection state 404 or read-onlyauto-protected state are rejected by the control module 106. In afurther embodiment, a LBA 202 in an auto-protected 406 partition remainsauto-protected until it is written. If at least one LBA 202 within theauto-protected 406 partition has been written the partition changes toread-only auto-protected 408. If the last LBA 202 in an auto-protectedpartition 406 is written, the read-only auto-protected 408 partitionwill transition to a WORM 404 protected partition.

In one embodiment, the protection states 402, 404, 406, 408 may berepresented in inquiry commands as binary values, denoted by a b suffix,or decimal values (shown in parentheses). For example, the unprotectedstate 402 may be represented as 00b (0 decimal), the WORM state 404 maybe represented as 01b (1 decimal), the auto-protected state 406 may berepresented as 10b (2 decimal), and the read-only auto protected state408 may be represented as 11b (3 decimal).

In a further embodiment, the protection module 308 includes a virtuallydeleted protected state (not shown). This virtually deleted state may beconfigured to denote that the WORM or auto-protected data has been“virtually deleted.” The virtually deleted data would still beread-accessible by the host for historical purposes, but the data wouldbe earmarked as “virtually deleted” for whatever reason, such as thedata is considered out-of-date or no longer relevant.

FIG. 5 is a schematic block diagram illustrating one embodiment of amode select command 500 in accordance with the SCSI-3 InterfaceStandard. The illustrated mode select command 500 is the SCSI (SmallComputer System Interface) command with command code 15 h 502. The modeselect command 500 is given herein by way of example for a statetransition command. For example, the mode select command 500 may be usedto initiate the transition 412 b from an unprotected state 402 to WORMprotected state 404 or 412 c from unprotected state 402 toauto-protected state 406 or 412 f from auto-protected state 406 tounprotected state 402. The mode select command 500 may be initiated bythe host system (subsequently also called initiator) and received by thecontrol module 106 via the communication interface 108 of the storagedevice 100. Mode select command 500 with command code 15 h 502 providesa means for the host to specify the parameter list length 504 andlogical unit 506 of the target storage device. The parameter list length504 specifies the size of the mode page to be transferred in bytes. TheMode Select command 500 is always succeeded by a mode page sent from thehost system to the storage device 100.

FIG. 6 is a schematic block diagram illustrating one embodiment of amode sense command 600 in accordance with the present invention. Themode sense command 600 allows the host to retrieve or inquire mode pageinformation, such as from a mode page from the storage device 100. Themode sense command 600 may be initiated by the host system (subsequentlyalso called initiator) and received by the control module 106 via thecommunication interface 108 of the storage device 100. The command code602 of the SCSI Mode Sense command is 1Ah. The mode sense command 600allows the host to specify a page code 604, and an allocation length606, which in turn specifies the maximum returned data size. Page code604 specifies the page code of the mode page to be retrieved, andlogical unit 608 of the target storage device. The allocation lengthspecifies the length of the mode page. As a result of the mode sensecommand 600 the storage device receiving it will return the appropriatemode page.

FIG. 7 is a schematic block diagram illustrating one embodiment of amode page 700 in accordance with the present invention. Allocationlength 606 of FIG. 6 specifies the number of bytes to be transferredfrom the storage media 104 to the host as result of the mode sensecommand 600, this is the size of the mode page 700. In one embodiment,the mode sense command 600 will allow the host to obtain the protectionstate of a partition or an individual LBA.

The mode page 700, sent by storage device as a response to the modesense command 600, allows the host system to inquire the state of apartition or LBA. Not all fields in the mode page 700 are used by themode sense command. For example if the mode sense command 600 field 604is set to 0Dh specifying for mode page code 0Dh the storage device mayreturn the mode page 700 with the following characteristic: field 702 isset to 0Dh, field 704 is set to 17h, field 705 is set to 1 if thestorage device is capable of supporting WORM partitions, field 706 isset to 1 if at least one protected partition is activated, field 708return the number of protected partitions which exist within the storagedevice, field 710 returns the number of the partition where thesubsequent fields 711, 712 and 713 apply to, field 711 specifies thestart address (or LBA) of the partition, field 712 outlines the endaddress of the partition and field 713 returns the protection status ofthat partition state which is one of unprotected 00b, WORM protected01b, auto-protected 10b or read-only auto-protected 11b. In thissequence the storage device will return the mode page 700 multiple timesfor each partition which is configured.

The mode select and mode sense command can be used in combination tomake an inquiry of the protection parameters such as the starting andending address (LBA) and protection state of a particular partition. Thesequence starts with sending a mode select command 500 specifying 15h infield 502 and 17h in field 504 and the logical unit address of thestorage device in field 506. Subsequently mode page 700 is sent withfield 710 set to the number of the partition for which the informationis requested, and all other fields in mode page 700 are set to 00hindicating that this is not a state transition. These two commands aresent from the host (initiator) to the storage device.

In one embodiment, the host then sends a mode sense command 600 withfield 602 set to 1Ah, field 604 set to 0Dh and field 606 set to 17hindicating the expected length of the mode page. Field 608 is set to theaddress of the storage device. As a response to this command sequencethe storage device returns mode page 700 where field 702 is set to 0Dh,field 704 is set to 17h, field 705 is set to 1 if the storage device iscapable of supporting WORM partitions, field 706 is set to 1 if at leastone protected partition is activated, field 708 returns the number ofprotected partitions which exist within the storage device, and field710 returns the number of the partition for which the information isrequested. In one embodiment, this number may be the same number whichwas sent previously. Field 711 specifies the start address (or LBA) ofthe partition, field 712 outlines the end address of the partition andfield 713 returns the protection status of that partition state which isone of unprotected 00b, WORM protected 01b, auto-protected 10b orread-only auto-protected 11b.

According to the SCSI standard, the mode pages are used bidirectionallybetween the storage device and the host system. In this invention, thehost system uses the mode page 700 in association with a MODE SELECTcommand to initiate a state transition. The host system also uses thismode page 700 in association with a MODE SENSE command to inquiry thestatus of a partition or LBA. The storage device derives the protectionstate for the partition(s) from the mode page. Therefore the mode pagesare stored in the storage device. There are usually multiple mode pages,and each mode page has a unique page code. The page code for theprotected partition mode page is exemplary set to 0Dh.

The page code 702 indicates that a protected partition is to be set.This is the unique page code which is used by the host system toinitiate state transitions or inquiry state transitions. The page codeof the protected partition mode page is exemplary set to 0Dh. The field704 or the mode page 700 defines the length of this mode page in bytes,for this example it is set to 25 bytes. The field WORM 705 indicateswhether or not the WORM Protection Mechanism is supported by the productand is only used for to inquiry protection states. The field Act 706indicates at least one Protected Partition is activated. This field isalso used with an inquiry command operation. If this field is set to “0”there are no protected partitions set. Otherwise, there are protectedpartitions set on this disk drive.

The field Maximum Number of Partitions 708 denotes the maximum number ofpartitions, that can be configured with a start and end address, e.g. anLBA address. This field is used with the inquiry operation. This is aproduct specific value and is usually assigned during manufacturing ofthe storage device. This value must not exceed FFFEh. With the fieldprotected partition 710 an existing partition can be specified. Settingthis field to a value of “0” specifies all partitions. A value of FFFFhindicates that the information for a particular LBA as specified infield 711 is to be returned.

The starting boundary 711 indicates the LBA at which this partitionsubject to the state transition or inquiry operation starts. The endingboundary 712 specifies at which LBA this partition subject to the statetransition or inquiry operation ends. The field 711 and 712 shall begreater than 0 and the ending boundary 712 must be equal or greater thanthe Starting boundary 711. The protection status 713 specifies theprotection status for this partition state which is one of eitherunprotected 00b, WORM protected 0lb, auto-protected 10b or read-onlyauto-protected 11b.

As outlined earlier, a protection status may be configured for a singleLBA or a range of LBA based on the allowable transitions in FIG. 4.Every consecutive series of LBAs that are to be associated with aprotection status of either 00b, 01b, 10b, or 11b is a protectedpartition. Hence, a protected partition may consist of any number ofLBAs, from 1 to the maximum number of LBAs on the medium.

In one embodiment, the control module 106 is configured to receiveexisting SCSI commands, such as mode select 500 and mode sense 600 inorder to create partitions with a WORM protected state 404 orauto-protected state 406, or retrieve the partition state that may be anunprotected state 402, a WORM protected state 404, an auto-protectedstate 406 or a read-only auto-protected state 408. The mode page 700includes information 710, 711, 712, 713 about a partition and theprotection parameters such as the range of LBAs and protection status tobe set. The protection module 308 may be configured to utilize theallowable states 402, 404, 406, 408 in accordance with the creation andmanipulation of partitions.

FIG. 7 gives by way of example mode page 700 code 0Dh 702 as oneembodiment to implement the present invention. Alternatively, oneskilled in the art of SCSI commands will recognize that a different pagecode of a reserved and not used mode page according to the SCSI standardmay also be used. The mode page 700 is used bidirectional between thestorage device 100 and the host. The host may utilize the mode page 700in association with a mode select 500 command to create partitions, i.e.“to select the mode.” The host uses this mode page 700 in associationwith a mode sense 600 command to specify a partition for which theprotection state 402, 404, 406, 408 is to be retrieved. The controlmodule 106 may also use the mode page 700 to obtain the data residing inthe partition and the corresponding protection state 402, 404, 406, 408and also to return it when requested to the host.

The schematic flow chart diagrams that follow are generally set forth aslogical flow chart diagrams. As such, the depicted order and labeledsteps are indicative of one embodiment of the presented method. Othersteps and methods may be conceived that are equivalent in function,logic, or effect to one or more steps, or portions thereof, of theillustrated method. Additionally, the format and symbols employed areprovided to explain the logical steps of the method and are understoodnot to limit the scope of the method. Although various arrow types andline types may be employed in the flow chart diagrams, they areunderstood not to limit the scope of the corresponding method. Indeed,some arrows or other connectors may be used to indicate only the logicalflow of the method. For instance, an arrow may indicate a waiting ormonitoring period of unspecified duration between enumerated steps ofthe depicted method. Additionally, the order in which a particularmethod occurs may or may not strictly adhere to the order of thecorresponding steps shown.

FIG. 8 is a schematic flow chart diagram illustrating one embodiment ofa method 800 for implementing allowable protection state transitions inaccordance with the present invention. The method 800 starts 802 and thecommunication module 302 of the control module 106 receives 804 the modeselect command 500 and the mode page 700 via interface 108. The parsemodule 306 then extracts 806 the LBAs and the new protection state fromthe mode page 700. Extracting 806 the LBAs and the protection state maycomprise generating a list of LBAs and the new protection state. Thecheck module 310 then verifies the actual protection states of thoseLBAs being obtained. In one embodiment, the actual state is theprotection state the storage media 104 has associated with eachrequested LBA. The check module 310 then obtains 808 the actualprotection states for the list of LBAs extracted from the command.

The protection module 308 then compares the new protection state withthe actual protection state and determines if the status transition isallowable 810. In one embodiment, the allowable transitions arepredetermined and defined as described above with reference to FIG. 4.If the transition to the new protection state is allowed 810 for eachLBA extracted 804 from the mode page, the write module 304 stores 812the new protection state and the method 800 ends 814 upon thecommunication module 302 returning a success response to the host.However, if the transition is not allowed 810 for any of the LBAs, theprotection module 308 prevents the transition and the communicationmodule 302 returns 813 an error such as a SCSI check condition status tothe host. In one embodiment, the error may be an “abnormal end of task,”or abend, error message. The method 800 then ends 814.

In one embodiment, the storage media 104 may be configured to store theinformation given by the mode select command 500 in an internal memorywhich may be part of the check module 310. For example, with anaffordable 1 MB memory chip the information of approximately 40,000protection partitions may be stored. This internal memory allows a fastaccess to this data for subsequent operations, such as processing writecommands. In a further embodiment, the protection partition informationmay be periodically written to the reserved area on the storage media104, typically during idle time.

FIG. 9 is a schematic flow chart diagram illustrating one embodiment ofa method 900 for the processing of write commands. The method 900 begins902 and the communication module 302 receives 904 a write command viathe communication interface 108. The parse module 306 then obtains 906all command addresses (LBAs) from the write command such as writecommand 1000. The command addresses comprise a starting LBA where thedata is to be written to, as well as the transfer length, whichindicates the number of sequential LBAs to be written. The check module310 then obtains 908 the actual protection states for the commandaddresses (LBAs). The LBAs obtained 906 from the write command 1000 maybe referred to as “CMD_LBA.” The protection module 308 then compares theaddresses from the command with the corresponding protection states onthe storage media 104. If the protection module 308 finds that theCMD_LBA correspond 910 to WORM-protected areas or read-only (RO)auto-protected areas, the protection module 308 prevents the writecommand and the communication module 302 returns 911 an error message,and the method 900 ends 912. In one embodiment, the error message maycomprise the abend error message described above.

Alternatively, if the check module 310 finds 910 that all CMD_LBA areassigned to writeable partitions, then the write module 304 writes 914the data to the storage media 104. If the write was not successful 916,then the control module 106 starts an error recovery process 918.Determining the success of a write could be, in one embodiment, made byperforming a write-verification or reading of the freshly written data.If the write was successful 916 the protection module 308 determines 920if the freshly written data was written to an auto-protected partition406. If not, the method 900 ends 912. Alternatively, if so, the writemodule 304 is configured to determine 922 if the partition is full. Thepartition is full if all LBAs pertaining to that partition are in stateread-only auto-protected 408. This information is obtained from thecheck module 310.

If the partition is full, the write module 304 changes 924 theprotection state of the partition to WORM-protected 404. If thepartition is not full, the write module 304 changes 926 the protectionstatus of the just-written LBAs and the partition itself to read-onlyauto-protect 408. The method 900 then ends 912.

FIG. 10 is a schematic block diagram illustrating one embodiment of awrite command 1000 having a logical unit number (LUN) 1002 in accordancewith the present invention. The write command 1000 may also include astarting LBA 1004, bytes 2-5, and a transfer length 1006, bytes 7-8. Inone embodiment, the CMD_LBAs are obtained from the starting LBA 1004 andthe transfer length 1006 divided by the LBA size plus one is equivalentto the ending LBA for that write command 1000. In one embodiment, thelogical unit numbers 1002 inherent in every SCSI interface may be usedto sort rewriteable data from WORM data. For example, rewritable dataI/O 402 may be sent across a first logical unit number (LUN-0) of thecommunication interface 108 of the storage device 100. Auto-protected406 data I/O could be sent across LUN-2 of the same communicationinterface 108 of the same storage device 100. WORM protected 404 I/Ocould be sent across LUN-3 of the same communication interface 108 ofthe same storage device 100. Data sent through LUN-0 may be saved on adifferent partition that that of the data of LUN-2 and LUN-3.

In order to maintain the data protection attribute of the protectionstates 402, 404, 406, 408, certain commands are prohibited. For example,the format unit command and the erase command will not be supported onpartitions of the storage media 104 which are in protection state WORMprotected 404, auto-protected 406 and read-only auto-protected 408. Ingeneral, all commands which would allow changing or deleting the datastored in a WORM protected or read-only auto-protected partition areprohibited and rejected by the storage controller via check condition.

FIG. 11 is a schematic block diagram illustrating one embodiment of amedium partition mode page 1100 in accordance with the presentinvention. Mode page 1100 is designated by page code 11h 1101. Thecontrol module 106 may be easily adapted to control single-reel tapecartridges and dual-reel tape cassettes. A tape cartridge or cassettecan have multiple partitions which may be managed from the host via modeset commands. Thus for a particular partition on the tape cartridge orcassette, the protection state can be set to (a) unprotected, (b) WORMprotected, and (c) auto-protected.

The mode pages may be used to transfer information about the protectionstate from the host to the tape drive. FIG. 11 illustrates the mediumpartition mode page 1100, according to INCITS T10/1434-D. Two bits 1104,00b-11b of the reserved field 1102, which have been previouslydiscussed, can be used to denote the protection state for the partition.In one embodiment, the Medium Format Recognition field 1106 may be usedto denote the protection state, especially if tape is being used as thestorage medium. Herein a scheme can be incorporated which shows theprotection state of a particular partition encoded in the byte and bits.Alternatively, device drivers that convert the SCSI mode sense and modeselect commands to ATA or IDE commands, for example, may be developed toextend the present invention to non-SCSI devices.

For stand-alone tape drives, the tape drive may store the protectionstate for a partition and for each logical block in that partition inthe initialization area for each partition of each removable tapecartridge or cassette. In one embodiment, the protection state for eachpartition may be stored in both the initialization area of the tapecartridge or cassette and in cartridge or enclosure memory.

FIG. 12 is a schematic block diagram illustrating one embodiment of amethod 1200 for protecting the control module 106 from intentionalcorruption of storage devices 100. An example of intentional corruptionof storage devices 100 would be someone intentionally taking out a diskpertaining to a WORM protected entity and modifying the data containedwithin. In one embodiment, the method 1200 starts 1202 and the controlmodule 106 detects 1204 that storage media 104 is broken.

Upon detecting 1204 a storage media 104 failure, the control module 106is configured to start 1206 appropriate error recovery and posts anerror message If no failure has been detected 1204 the method 1200continuously checks for disk failures. One example of an appropriateerror recovery in a RAID system is, for example, to rebuild the RAID.When the disk drive has been replaced 1208, the control module 106checks 1210 whether the same disk has been inserted again, as this couldpoint to intentional manipulation, where someone removes the disk,manipulates it and re-inserts it. In one embodiment, checking 1210 forthe same disk comprises comparing the unique serial number andmanufacturer ID of the storage device 100. If the disk is not the samedisk as was previously removed, the control module 106 considers this anew disk and integrates 1216 the disk.

If the disk is 1210 the same disk as before the control module obtains1212 the passwords to override the protection. The password must beentered by the user that inserted the disk. If the passwords are notcorrect 1214 the control module 106 increments 1220 a counter. Thecounter is configured to maintain the number of incorrect passwordattempts. If the counter is greater 1222 than a predefined maximum, thecontrol module 106 will isolate the storage media 104 and return 1224 anerror state. The error may denote a state where an unauthorized attemptto manipulate the data has been detected and eliminated. If the counteris not greater 1222 than the maximum, the control module 106 againattempts to obtain the password 1212 from the user.

When the passwords are validated 1214, the control module 106 willintegrate 1216 the disk. For example, in the case of an RAID array arebuild will start. If the disk is the same as before the controllermodule 106 will attempt to perform diagnostics with the disk and scanthe medium for possible defects. If no defects are found the data of thedisk is considered valid and so the integration might not require arebuild. However, if the disk is 1210 not the same, the control module106 integrates 1216 the disk and considers it a new empty disk. Thiswill require a rebuild. The method 1200 then ends 1226.

The present invention may be embodied in other specific forms withoutdeparting from its spirit or essential characteristics. For example, theSCSI commands described herein could be implemented over a Fibre Channel(“FC”) physical layer. Alternately, other protocols, such as FICON,Ethernet, Gigabit Ethernet, Infiniband, TCP/IP, iSCSI, ATA, SATA, andthe like, could be used without limitation. The described embodimentsare to be considered in all respects only as illustrative and notrestrictive. The scope of the invention is, therefore, indicated by theappended claims rather than by the foregoing description. All changeswhich come within the meaning and range of equivalency of the claims areto be embraced within their scope.

1. An apparatus for setting protection states of protected partitions inhard disk drive storage media, the apparatus comprising: a code storagedevice storing executable code; a processor executing the executablecode, the executable code comprising a control module receivingprotection state transition commands from a host for a target partitioncomprising a plurality of Logical Block Address (LBA); a check moduleverifying a protection state of a plurality of protection states for thetarget partition, the plurality of protection states comprising anunprotected state that allows the performance of an indefinite number ofread/write operations to a first LBA of the target partition; anauto-protected state allowing exactly one write operation to the firstLBA; a read-only auto-protected state preventing write, erase, andformat commands to the first LBA after the first LBA has been written toonce, wherein at least one LBA of the plurality of LBA in the targetpartition is unwritten to a Write Once Read Many (WORM) protected statepreventing write, erase, and format commands to all logical blockaddresses in the first partition; and a write module writing theprotection state of the target partition to a reserved area of thestorage media according to a plurality of defined allowable statetransitions, the plurality of defined allowable state transitionscomprising a transition from the unprotected state to one of theunprotected state for normal read/write operation, the auto-protectedstate, and the WORM protected state, a transition from theauto-protected state to one of the unprotected state or the read-onlyauto-protected state, and a transition from the read-only auto-protectedstate to the WORM protected state when all LBA in the target partitionare written.
 2. The apparatus of claim 1, further comprising a parsemodule extracting LBAs from the protection state transition command. 3.The apparatus of claim 2, the control module further receivingprotection states for the LBA from the host and the check modulecomparing the received protection states with stored protection statesfor the LBA.
 4. The apparatus of claim 3, the control module furthercommunicating a SCSI mode page to the host in response to a SCSI modesense command, the mode sense command comprising a partition number andthe page code, the mode page comprising the page code, an indication ifa storage device supports WORM Partitions, an indication if anypartition is protected, the partition number, and a partition protectionstate.
 5. The apparatus of claim 4, the control module furthercommunicating a SCSI check condition status with an abnormal end of taskerror if the transition is not allowable, and wherein the partitionfurther comprises a variable number of LBAs.
 6. A system for settingprotection states of protected partitions in hard disk drive storagemedia, the system comprising: a host device; a storage device coupledwith the host, the storage device comprising an enclosure having storagemedia, a code storage device storing executable code, and a processorexecuting the executable code, the executable code comprising a controlmodule receiving protection state transition commands from the host fora target partition comprising a plurality of LBAs; a check moduleverifying a protection state of a plurality of protection states for thetarget partition, the plurality of protection states comprising anunprotected state that allows the performance of an indefinite number ofread/write operations to a first LBA of the target partition; anauto-protected state allowing exactly one write operation to the firstLBA; a read-only auto-protected state preventing write, erase, andformat commands to the first LBA after the first LBA has been written toonce, wherein at least one LBA of the plurality of LBA in the targetpartition is unwritten to; a WORM protected state preventing write,erase, and format commands to all logical block addresses in the firstpartition; and a write module writing the protection state of the targetpartition to a reserved area of the storage media according to aplurality of defined allowable state transitions, the plurality ofdefined allowable state transitions comprising a transition from theunprotected state to one of the unprotected state for normal read/writeoperation, the auto-protected state, and the WORM protected state, atransition from the auto-protected state to one of the unprotected stateor the read-only auto-protected state, and a transition from theread-only auto-protected state to the WORM protected state when all LBAin the target partition are written.
 7. The system of claim 6, furthercomprising a parse module extracting LBAs from the protection statetransition command.
 8. The system of claim 7, the control module furtherreceiving protection states for the LBA from the host and the checkmodule comparing the received protection states with stored protectionstates for the LBA.
 9. The system of claim 8, the control module furthercommunicating a SCSI mode page to the host in response to a SCSI modesense command, the mode sense command comprising a partition number andthe page code, the mode page comprising the page code, an indication ifa storage device supports WORM Partitions, an indication if anypartition is protected, the partition number, and a partition protectionstate.
 10. The system of claim 9, the control module furthercommunicating a SCSI check condition status with an abnormal end of taskerror if the transition is not allowable, and wherein the partitionfurther comprises a variable number of LBAs.
 11. A code storage devicestoring executable code executed by a processor to perform an operationfor setting protection states of protected partition in hard disk drivestorage media, the operation comprising: receiving protection statetransition commands from a host for a target partition comprising aplurality of LBAs; verifying a protection state of a plurality ofprotection states for the target partition, the plurality of protectionstates comprising an unprotected state that allows the performance of anindefinite number of read/write operations to a first LBA of the targetpartition; an auto-protected state allowing exactly one write operationto the first LBA; a read-only auto-protected state preventing write,erase, and format commands to the first LBA after the first LBA has beenwritten to once, wherein at least one LBA of the plurality of LBA in thetarget partition is unwritten to; a WORM protected state preventingwrite, erase, and format commands to all logical block addresses in thefirst partition; and writing the protection state of the targetpartition to a reserved area of the storage media according to aplurality of defined allowable state transitions, the plurality ofdefined allowable state transitions comprising a transition from theunprotected state to one of the unprotected state for normal read/writeoperation, the auto-protected state, and the WORM protected state, atransition from the auto-protected state to one of the unprotected stateor the read-only auto-protected state, and a transition from theread-only auto-protected state to the WORM protected state when all LBAin the target partition are written.
 12. The code storage device ofclaim 11, the operation further comprising extracting the LBAs andprotection statuses from a read command and the write command.
 13. Thecode storage device of claim 11, the operation further comprisingextracting LBAs from the protection state transition command, receivingprotection states for the LBA from the host, and comparing the receivedprotection states with stored protection states for the LBA.
 14. Thecode storage device of claim 13, the operation further comprisingcommunicating a SCSI mode page to the host in response to a SCSI modesense command, the mode sense command comprising a partition number andthe page code, the mode page comprising the page code, an indication ifa storage device supports WORM Partitions, an indication if anypartition is protected, the partition number, and a partition protectionstate.
 15. The code storage device of claim 14, the operation furthercomprising communicating a SCSI check condition status with an abnormalend of task error if the transition is not allowable, and wherein thepartition further comprises a variable number of LBAs.
 16. A method forsetting protection states of protected partitions in hard disk drivestorage media, the method comprising: receiving protection statetransition commands from a host for a target partition comprising aplurality of LBAs; verifying, by user of a processor, a protection stateof a plurality of protection states for the target partition, theplurality of protection states comprising an unprotected state thatallows the performance of an indefinite number of read/write operationsto a first LBA of the target partition; an auto-protected state allowingexactly one write operation to the first LBA; a read-only auto-protectedstate preventing write, erase, and format commands to the first LBAafter the first LBA has been written to once, wherein at least one LBAof the plurality of LBA in the target partition is unwritten to; a WORMprotected state preventing write, erase, and format commands to alllogical block addresses in the first partition; and writing, by use of aprocessor, the protection state of the target partition to a reservedarea of the storage media according to a plurality of defined allowablestate transitions, the plurality of defined allowable state transitionscomprising a transition from the unprotected state to one of theunprotected state for normal read/write operation, the auto-protectedstate, and the WORM protected state, a transition from theauto-protected state to one of the unprotected state or the read-onlyauto-protected state, and a transition from the read-only auto-protectedstate to the WORM protected state when all LBA in the target partitionare written.
 17. The method of claim 16, wherein the method comprisesextracting the LBAs and protection statuses from the protection statetransition command.
 18. The method of claim 17, the method furthercomprising extracting LBAs from the protection state transition command,receiving protection states for the LBA from the host, and comparing thereceived protection states with stored protection states for the LBA.19. The method of claim 18, the method further comprising communicatinga SCSI mode page to the host in response to a SCSI mode sense command,the mode sense command comprising a partition number and the page code,the mode page comprising the page code, an indication if a storagedevice supports WORM Partitions, an indication if any partition isprotected, the partition number, and a partition protection state. 20.The method of claim 19, the method further comprising communicating aSCSI check condition status with an abnormal end of task error if thetransition is not allowable, and wherein the partition further comprisesa variable number of LBAs.